deep-search-gui.py

"""
Deep Search GUI
Copyright (C) 2026 Alessandro Orlando

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>.
"""

import csv
import datetime as dt
import hashlib
import os
import subprocess
import threading
import tkinter as tk
from tkinter import filedialog, messagebox, ttk


try:
    import pytsk3
except ImportError:  # pragma: no cover
    pytsk3 = None


TYPE_EXTENSIONS = {
    "All": set(),
    "Images": {"jpg", "jpeg", "png", "gif", "bmp", "tiff", "webp", "raw"},
    "Documents": {"pdf", "doc", "docx", "odt", "txt", "rtf", "xls", "xlsx", "ppt", "pptx"},
    "Audio": {"mp3", "wav", "flac", "aac", "ogg", "m4a"},
    "Video": {"mp4", "mkv", "avi", "mov", "wmv", "webm", "mpeg"},
    "Archives": {"zip", "rar", "7z", "tar", "gz", "bz2", "xz", "iso"},
    "Executables": {"exe", "msi", "apk", "bat", "sh", "bin"},
    "Code": {"c", "cpp", "h", "hpp", "py", "js", "ts", "java", "ino", "json", "xml"},
}


class ImgFileTypeSearchApp:
    def __init__(self, root: tk.Tk):
        self.root = root
        self.root.title("Deep Search .img Disk image - © Alessandro Orlando - GNU AGPLv3")
        self.root.geometry("1100x700")

        self.image_path = tk.StringVar()
        self.type_var = tk.StringVar(value="Documents")
        self.extra_ext_var = tk.StringVar()
        self.include_deleted_var = tk.BooleanVar(value=False)
        self.recover_deleted_var = tk.BooleanVar(value=False)
        self.recovery_dir_var = tk.StringVar()
        self.status_var = tk.StringVar(value="Select a .img file and start the scan")
        self.scanning = False
        self.results = []
        self.recovered_count = 0
        self.last_export_path = None
        self.stop_event = threading.Event()

        self._build_ui()

    def _build_ui(self):
        top_frame = ttk.Frame(self.root, padding=12)
        top_frame.pack(fill="x")

        ttk.Label(top_frame, text="Disk image (.img):").grid(row=0, column=0, sticky="w")
        ttk.Entry(top_frame, textvariable=self.image_path, width=85).grid(row=1, column=0, padx=(0, 8), sticky="we")
        ttk.Button(top_frame, text="Browse", command=self.select_image).grid(row=1, column=1, sticky="e")

        ttk.Label(top_frame, text="File type:").grid(row=2, column=0, pady=(10, 0), sticky="w")
        type_combo = ttk.Combobox(
            top_frame,
            textvariable=self.type_var,
            values=list(TYPE_EXTENSIONS.keys()),
            state="readonly",
            width=26,
        )
        type_combo.grid(row=3, column=0, sticky="w")

        ttk.Label(top_frame, text="Extra extensions (e.g.: log,csv,bak):").grid(row=2, column=1, pady=(10, 0), sticky="w")
        ttk.Entry(top_frame, textvariable=self.extra_ext_var, width=34).grid(row=3, column=1, sticky="w")

        options_frame = ttk.Frame(top_frame)
        options_frame.grid(row=4, column=0, columnspan=2, pady=(10, 0), sticky="w")

        include_deleted_cb = ttk.Checkbutton(
            options_frame,
            text="Include deleted files (forensic scan)",
            variable=self.include_deleted_var,
            command=self._toggle_recovery_controls,
        )
        include_deleted_cb.grid(row=0, column=0, padx=(0, 10), sticky="w")

        recover_deleted_cb = ttk.Checkbutton(
            options_frame,
            text="Recover deleted files",
            variable=self.recover_deleted_var,
            command=self._toggle_recovery_controls,
        )
        recover_deleted_cb.grid(row=0, column=1, padx=(0, 10), sticky="w")

        ttk.Label(options_frame, text="Recovery folder:").grid(row=1, column=0, pady=(6, 0), sticky="w")
        self.recovery_dir_entry = ttk.Entry(options_frame, textvariable=self.recovery_dir_var, width=70)
        self.recovery_dir_entry.grid(row=2, column=0, padx=(0, 8), sticky="we")
        self.recovery_dir_button = ttk.Button(options_frame, text="Select folder", command=self.select_recovery_dir)
        self.recovery_dir_button.grid(row=2, column=1, sticky="w")

        options_frame.columnconfigure(0, weight=1)

        button_frame = ttk.Frame(top_frame)
        button_frame.grid(row=5, column=0, columnspan=2, pady=(12, 0), sticky="w")

        ttk.Button(button_frame, text="Start scan", command=self.start_scan).pack(side="left", padx=(0, 8))
        self.stop_button = ttk.Button(button_frame, text="Stop scan", command=self.stop_scan, state="disabled")
        self.stop_button.pack(side="left", padx=(0, 8))
        ttk.Button(button_frame, text="Export CSV", command=self.export_csv).pack(side="left", padx=(0, 8))
        ttk.Button(button_frame, text="Recover selected", command=self.recover_selected_files).pack(side="left", padx=(0, 8))
        ttk.Button(button_frame, text="Open last CSV", command=self.open_last_csv).pack(side="left", padx=(0, 8))
        ttk.Button(button_frame, text="Clear", command=self.clear_results).pack(side="left")

        top_frame.columnconfigure(0, weight=1)

        columns = ("seq", "partition", "path", "name", "ext", "deleted", "size", "mtime", "sha256", "recovered")
        self.tree = ttk.Treeview(self.root, columns=columns, show="headings")
        self.tree.heading("seq", text="#")
        self.tree.heading("partition", text="Partition")
        self.tree.heading("path", text="Path")
        self.tree.heading("name", text="Filename")
        self.tree.heading("ext", text="Extension")
        self.tree.heading("deleted", text="Deleted")
        self.tree.heading("size", text="Size (bytes)")
        self.tree.heading("mtime", text="Last modified")
        self.tree.heading("sha256", text="SHA-256")
        self.tree.heading("recovered", text="Recovery path")

        self.tree.column("seq", width=60, anchor="center")
        self.tree.column("partition", width=140, anchor="w")
        self.tree.column("path", width=360, anchor="w")
        self.tree.column("name", width=220, anchor="w")
        self.tree.column("ext", width=100, anchor="center")
        self.tree.column("deleted", width=90, anchor="center")
        self.tree.column("size", width=130, anchor="e")
        self.tree.column("mtime", width=150, anchor="center")
        self.tree.column("sha256", width=300, anchor="w")
        self.tree.column("recovered", width=260, anchor="w")

        scrollbar_y = ttk.Scrollbar(self.root, orient="vertical", command=self.tree.yview)
        scrollbar_x = ttk.Scrollbar(self.root, orient="horizontal", command=self.tree.xview)
        self.tree.configure(yscrollcommand=scrollbar_y.set, xscrollcommand=scrollbar_x.set)

        self.tree.pack(fill="both", expand=True, padx=12, pady=(8, 0))
        scrollbar_y.pack(side="right", fill="y", pady=(8, 0))
        scrollbar_x.pack(fill="x", padx=12)

        status = ttk.Label(self.root, textvariable=self.status_var, padding=(12, 8))
        status.pack(fill="x")

        self._toggle_recovery_controls()

    def _toggle_recovery_controls(self):
        include_deleted = self.include_deleted_var.get()
        recover_deleted = self.recover_deleted_var.get()

        if not include_deleted and recover_deleted:
            self.recover_deleted_var.set(False)
            recover_deleted = False

        state = "normal" if include_deleted else "disabled"
        self.recovery_dir_entry.configure(state=state)
        self.recovery_dir_button.configure(state=state)

        if include_deleted and self.recover_deleted_var.get():
            self.recovery_dir_entry.configure(state="normal")
            self.recovery_dir_button.configure(state="normal")
        elif include_deleted:
            self.recovery_dir_entry.configure(state="disabled")
            self.recovery_dir_button.configure(state="disabled")

    def select_recovery_dir(self):
        path = filedialog.askdirectory(title="Select folder for forensic recovery")
        if path:
            self.recovery_dir_var.set(path)

    def select_image(self):
        path = filedialog.askopenfilename(
            title="Select disk image",
            filetypes=[("Disk image", "*.img"), ("All files", "*.*")],
        )
        if path:
            self.image_path.set(path)

    def clear_results(self):
        self.results.clear()
        self.recovered_count = 0
        for item in self.tree.get_children():
            self.tree.delete(item)
        self.status_var.set("Results cleared")

    def export_csv(self):
        if not self.results:
            messagebox.showinfo("No results", "There are no results to export")
            return

        default_name = f"deep-search-results-{dt.datetime.now().strftime('%Y%m%d_%H%M%S')}.csv"

        out = filedialog.asksaveasfilename(
            title="Save results",
            defaultextension=".csv",
            filetypes=[("CSV", "*.csv")],
            initialfile=default_name,
        )
        if not out:
            return

        export_rows = sorted(
            self.results,
            key=lambda row: (row.get("partition", ""), row.get("path", ""), row.get("name", "")),
        )

        fieldnames = [
            "Filename",
            "File Path",
            "Deleted",
            "Recovered",
            "Recovery Path",
            "Recovery Source",
            "Found SHA-256",
            "Recovered SHA-256",
        ]

        with open(out, "w", newline="", encoding="utf-8-sig") as fp:
            writer = csv.DictWriter(fp, fieldnames=fieldnames)
            writer.writeheader()
            for row in export_rows:
                directory_path = row.get("path", "/")
                filename = row.get("name", "")
                if directory_path == "/":
                    full_path = f"/{filename}"
                else:
                    full_path = f"{directory_path}/{filename}"
                compact_path = self._compact_file_path(full_path)

                writer.writerow(
                    {
                        "Filename": filename,
                        "File Path": compact_path,
                        "Deleted": "Yes" if row.get("deleted") else "No",
                        "Recovered": "Yes" if row.get("recovered_path") else "No",
                        "Recovery Path": row.get("recovered_path", ""),
                        "Recovery Source": row.get("recovery_source", ""),
                        "Found SHA-256": row.get("sha256", ""),
                        "Recovered SHA-256": row.get("recovered_sha256", ""),
                    }
                )

        self.last_export_path = out
        self.status_var.set(f"CSV exported: {out} ({len(export_rows)} rows)")

    def _get_row_by_seq(self, seq_value):
        try:
            seq = int(seq_value)
        except Exception:
            return None
        if seq < 1 or seq > len(self.results):
            return None
        return self.results[seq - 1]

    def _build_recovery_output_path(self, recovery_dir, partition_name, parent_path, name, inode):
        partition_folder = self._sanitize_path_component(partition_name)
        relative_parent = (parent_path or "/").strip("/")
        safe_segments = [self._sanitize_path_component(seg) for seg in relative_parent.split("/") if seg]
        output_dir = os.path.join(recovery_dir, partition_folder, *safe_segments)
        os.makedirs(output_dir, exist_ok=True)

        safe_name = self._sanitize_path_component(name)
        out_name = f"{safe_name}__inode_{inode}" if inode else f"{safe_name}__recovered"
        out_path = os.path.join(output_dir, out_name)

        if os.path.exists(out_path):
            base, ext = os.path.splitext(out_path)
            suffix = 1
            while os.path.exists(f"{base}_{suffix}{ext}"):
                suffix += 1
            out_path = f"{base}_{suffix}{ext}"

        return out_path

    def _recover_inode_to_path(self, img_info, start_sector, inode, expected_size, out_path):
        fs_info = pytsk3.FS_Info(img_info, offset=int(start_sector) * 512)
        fs_file = fs_info.open_meta(inode=inode)
        if fs_file is None:
            return False

        meta = getattr(getattr(fs_file, "info", None), "meta", None)
        if meta is None:
            return False

        size = int(expected_size or getattr(meta, "size", 0) or 0)
        chunk_size = 1024 * 1024

        with open(out_path, "wb") as out_fp:
            offset = 0
            while offset < size:
                to_read = min(chunk_size, size - offset)
                data = fs_file.read_random(offset, to_read)
                if not data:
                    break
                out_fp.write(data)
                offset += len(data)

        return True

    def _hash_entry_sha256(self, entry, expected_size):
        try:
            hasher = hashlib.sha256()
            chunk_size = 1024 * 1024
            size = int(expected_size or 0)
            offset = 0

            while offset < size:
                to_read = min(chunk_size, size - offset)
                data = entry.read_random(offset, to_read)
                if not data:
                    break
                hasher.update(data)
                offset += len(data)

            return hasher.hexdigest()
        except Exception:
            return ""

    def _hash_file_sha256(self, file_path):
        try:
            hasher = hashlib.sha256()
            with open(file_path, "rb") as fp:
                while True:
                    chunk = fp.read(1024 * 1024)
                    if not chunk:
                        break
                    hasher.update(chunk)
            return hasher.hexdigest()
        except Exception:
            return ""

    def recover_selected_files(self):
        if pytsk3 is None:
            messagebox.showerror(
                "Missing dependency",
                "Module 'pytsk3' not found. Install with: pip install pytsk3",
            )
            return

        image = self.image_path.get().strip()
        if not image:
            messagebox.showwarning("Missing image", "Select a .img file first")
            return

        selected = self.tree.selection()
        if not selected:
            messagebox.showinfo("No selection", "Select at least one file from results")
            return

        recovery_dir = self.recovery_dir_var.get().strip()
        if not recovery_dir:
            recovery_dir = filedialog.askdirectory(title="Select external folder for forensic recovery")
            if not recovery_dir:
                return
            self.recovery_dir_var.set(recovery_dir)

        try:
            os.makedirs(recovery_dir, exist_ok=True)
        except Exception as exc:
            messagebox.showerror("Recovery folder error", str(exc))
            return

        recovered_ok = 0
        recovered_fail = 0

        try:
            img_info = pytsk3.Img_Info(image)
        except Exception as exc:
            messagebox.showerror("Image open error", str(exc))
            return

        for item_id in selected:
            values = self.tree.item(item_id, "values")
            if not values:
                recovered_fail += 1
                continue

            row = self._get_row_by_seq(values[0])
            if not row:
                recovered_fail += 1
                continue

            inode = int(row.get("inode", 0) or 0)
            start_sector = int(row.get("partition_start", 0) or 0)
            if inode <= 0:
                recovered_fail += 1
                continue

            out_path = self._build_recovery_output_path(
                recovery_dir,
                row.get("partition", "Image root"),
                row.get("path", "/"),
                row.get("name", "unknown"),
                inode,
            )

            try:
                ok = self._recover_inode_to_path(
                    img_info,
                    start_sector,
                    inode,
                    int(row.get("size", 0) or 0),
                    out_path,
                )
                if ok and os.path.exists(out_path):
                    row["recovered_path"] = out_path
                    row["recovery_source"] = "selected_manual"
                    row["recovered_sha256"] = self._hash_file_sha256(out_path)
                    recovered_ok += 1
                else:
                    recovered_fail += 1
            except Exception:
                recovered_fail += 1

        for item_id in selected:
            values = self.tree.item(item_id, "values")
            if not values:
                continue
            row = self._get_row_by_seq(values[0])
            if not row:
                continue
            self.tree.item(
                item_id,
                values=(
                    row.get("seq", ""),
                    row.get("partition", ""),
                    row.get("path", ""),
                    row.get("name", ""),
                    row.get("ext", ""),
                    "Yes" if row.get("deleted") else "No",
                    row.get("size", 0),
                    row.get("mtime", ""),
                    row.get("sha256", ""),
                    row.get("recovered_path", ""),
                ),
            )

        self.recovered_count += recovered_ok
        self.status_var.set(
            f"Forensic recovery completed. Success: {recovered_ok}, failed: {recovered_fail}, total recovered: {self.recovered_count}"
        )
        messagebox.showinfo(
            "Forensic recovery",
            f"Recovered: {recovered_ok}\nFailed: {recovered_fail}\nDestination: {recovery_dir}",
        )

    def _compact_file_path(self, full_path):
        normalized = str(full_path).replace("\\", "/")
        segments = [segment for segment in normalized.split("/") if segment]

        if not segments:
            return "/"
        if len(segments) <= 3:
            return "/" + "/".join(segments)

        return ".../" + "/".join(segments[-3:])

    def open_last_csv(self):
        if not self.last_export_path or not os.path.exists(self.last_export_path):
            messagebox.showinfo("CSV not available", "Export a valid CSV file first")
            return

        try:
            subprocess.Popen(["xdg-open", self.last_export_path])
        except Exception as exc:
            messagebox.showerror("CSV open error", str(exc))

    def start_scan(self):
        if self.scanning:
            return

        if pytsk3 is None:
            messagebox.showerror(
                "Missing dependency",
                "Module 'pytsk3' not found. Install with: pip install pytsk3",
            )
            return

        image = self.image_path.get().strip()
        if not image:
            messagebox.showwarning("Missing image", "Select a .img file first")
            return

        target_ext = self._build_extension_filter()
        include_deleted = bool(self.include_deleted_var.get())
        recover_deleted = bool(self.recover_deleted_var.get())
        recovery_dir = self.recovery_dir_var.get().strip()

        if recover_deleted and not include_deleted:
            messagebox.showwarning("Invalid options", "Enable deleted file scan before recovery")
            return

        if recover_deleted and not recovery_dir:
            messagebox.showwarning("Missing recovery folder", "Select an external folder for recovered files")
            return

        if recover_deleted:
            try:
                os.makedirs(recovery_dir, exist_ok=True)
            except Exception as exc:
                messagebox.showerror("Recovery folder error", str(exc))
                return

        self.clear_results()
        self.scanning = True
        self.stop_event.clear()
        self.stop_button.configure(state="normal")
        self.status_var.set("Scan in progress...")

        worker = threading.Thread(
            target=self._scan_worker,
            args=(image, target_ext, include_deleted, recover_deleted, recovery_dir),
            daemon=True,
        )
        worker.start()

    def stop_scan(self):
        if not self.scanning:
            return
        self.stop_event.set()
        self.status_var.set(f"Stopping scan... Found: {len(self.results)} files")

    def _build_extension_filter(self):
        selected_type = self.type_var.get()
        extensions = set(TYPE_EXTENSIONS.get(selected_type, set()))
        extra = self.extra_ext_var.get().strip()
        if extra:
            parsed = {chunk.strip().lower().lstrip(".") for chunk in extra.split(",") if chunk.strip()}
            extensions.update(parsed)
        return extensions

    def _safe_decode(self, value):
        if isinstance(value, bytes):
            return value.decode("utf-8", errors="replace")
        return str(value)

    def _fmt_ts(self, timestamp):
        if not timestamp:
            return ""
        try:
            return dt.datetime.fromtimestamp(int(timestamp)).strftime("%Y-%m-%d %H:%M:%S")
        except Exception:
            return ""

    def _append_result(self, row):
        if self.stop_event.is_set():
            return
        row["seq"] = len(self.results) + 1
        self.results.append(row)
        self.root.after(
            0,
            lambda r=row: self.tree.insert(
                "",
                "end",
                values=(
                    r["seq"],
                    r["partition"],
                    r["path"],
                    r["name"],
                    r["ext"],
                    "Yes" if r.get("deleted") else "No",
                    r["size"],
                    r["mtime"],
                    r.get("sha256", ""),
                    r.get("recovered_path", ""),
                ),
            ),
        )
        self.root.after(
            0,
            lambda count=len(self.results), recovered=self.recovered_count: self.status_var.set(
                f"Scan in progress... Found: {count} files, recovered: {recovered}"
            ),
        )

    def _is_deleted_meta(self, meta):
        flags = int(getattr(meta, "flags", 0) or 0)
        unalloc = int(getattr(pytsk3, "TSK_FS_META_FLAG_UNALLOC", 0) or 0)
        alloc = int(getattr(pytsk3, "TSK_FS_META_FLAG_ALLOC", 0) or 0)

        if unalloc and (flags & unalloc):
            return True
        if alloc and (flags & alloc):
            return False
        return False

    def _sanitize_path_component(self, value):
        raw = self._safe_decode(value)
        cleaned = "".join(ch if ch.isalnum() or ch in ("-", "_", ".") else "_" for ch in raw).strip("._")
        return cleaned or "unknown"

    def _recover_deleted_entry(self, entry, partition_name, parent_path, name, recovery_dir):
        try:
            meta = getattr(entry.info, "meta", None)
            if meta is None:
                return ""

            size = int(getattr(meta, "size", 0) or 0)
            inode = int(getattr(meta, "addr", 0) or 0)

            out_path = self._build_recovery_output_path(recovery_dir, partition_name, parent_path, name, inode)

            chunk_size = 1024 * 1024
            with open(out_path, "wb") as out_fp:
                offset = 0
                while offset < size:
                    to_read = min(chunk_size, size - offset)
                    data = entry.read_random(offset, to_read)
                    if not data:
                        break
                    out_fp.write(data)
                    offset += len(data)

            if os.path.getsize(out_path) == 0 and size > 0:
                os.remove(out_path)
                return ""

            self.recovered_count += 1
            return out_path
        except Exception:
            return ""

    def _scan_directory(self, fs_info, directory, parent_path, partition_name, partition_start, target_ext, include_deleted, recover_deleted, recovery_dir):
        for entry in directory:
            if self.stop_event.is_set():
                return

            if not hasattr(entry, "info") or not getattr(entry.info, "name", None):
                continue

            name_raw = entry.info.name.name
            if name_raw in (b".", b".."):
                continue

            name = self._safe_decode(name_raw)
            meta = getattr(entry.info, "meta", None)
            if meta is None:
                continue

            current_path = f"{parent_path}/{name}" if parent_path else f"/{name}"
            is_deleted = self._is_deleted_meta(meta)

            if is_deleted and not include_deleted:
                continue

            if meta.type == pytsk3.TSK_FS_META_TYPE_DIR:
                if is_deleted:
                    continue
                try:
                    child_dir = entry.as_directory()
                    self._scan_directory(
                        fs_info,
                        child_dir,
                        current_path,
                        partition_name,
                          partition_start,
                        target_ext,
                        include_deleted,
                        recover_deleted,
                        recovery_dir,
                    )
                except Exception:
                    continue
                continue

            if meta.type != pytsk3.TSK_FS_META_TYPE_REG:
                continue

            ext = ""
            if "." in name:
                ext = name.rsplit(".", 1)[-1].lower()

            if target_ext and ext not in target_ext:
                continue

            recovered_path = ""
            if is_deleted and recover_deleted and recovery_dir:
                recovered_path = self._recover_deleted_entry(entry, partition_name, parent_path or "/", name, recovery_dir)

            recovery_source = ""
            recovered_sha256 = ""
            if recovered_path:
                recovery_source = "deleted_auto_scan"
                recovered_sha256 = self._hash_file_sha256(recovered_path)

            file_size = int(meta.size or 0)
            found_sha256 = self._hash_entry_sha256(entry, file_size)

            row = {
                "partition": partition_name,
                "path": parent_path or "/",
                "name": name,
                "ext": ext,
                "deleted": is_deleted,
                "inode": int(getattr(meta, "addr", 0) or 0),
                "partition_start": int(partition_start or 0),
                "size": file_size,
                "mtime": self._fmt_ts(getattr(meta, "mtime", 0)),
                "sha256": found_sha256,
                "recovered_path": recovered_path,
                "recovery_source": recovery_source,
                "recovered_sha256": recovered_sha256,
            }
            self._append_result(row)

    def _scan_partition(self, img_info, start_sector, partition_name, target_ext, include_deleted, recover_deleted, recovery_dir):
        if self.stop_event.is_set():
            return
        offset = int(start_sector) * 512
        fs_info = pytsk3.FS_Info(img_info, offset=offset)
        root_dir = fs_info.open_dir(path="/")
        self._scan_directory(
            fs_info,
            root_dir,
            "",
            partition_name,
            int(start_sector or 0),
            target_ext,
            include_deleted,
            recover_deleted,
            recovery_dir,
        )

    def _scan_worker(self, image_path, target_ext, include_deleted, recover_deleted, recovery_dir):
        total_found = 0
        errors = []
        try:
            img_info = pytsk3.Img_Info(image_path)
            scanned_any_partition = False

            try:
                volume = pytsk3.Volume_Info(img_info)
                for idx, part in enumerate(volume):
                    if self.stop_event.is_set():
                        break
                    if part.len <= 0:
                        continue
                    desc = self._safe_decode(part.desc).strip() or f"Partition {idx}"
                    partition_name = f"{idx}: {desc}"
                    try:
                        self._scan_partition(
                            img_info,
                            part.start,
                            partition_name,
                            target_ext,
                            include_deleted,
                            recover_deleted,
                            recovery_dir,
                        )
                        scanned_any_partition = True
                    except Exception as exc:
                        errors.append(f"{partition_name}: {exc}")
            except Exception:
                try:
                    fs_info = pytsk3.FS_Info(img_info)
                    root_dir = fs_info.open_dir(path="/")
                    self._scan_directory(
                        fs_info,
                        root_dir,
                        "",
                        "Image root",
                          0,
                        target_ext,
                        include_deleted,
                        recover_deleted,
                        recovery_dir,
                    )
                    scanned_any_partition = True
                except Exception as exc:
                    errors.append(f"Image not readable as filesystem: {exc}")

            total_found = len(self.results)
            if self.stop_event.is_set():
                msg = f"Scan stopped: {total_found} files found, recovered: {self.recovered_count}"
                self.root.after(0, lambda: self.status_var.set(msg))
                self.root.after(
                    0,
                    lambda: messagebox.showinfo(
                        "Scan stopped",
                        f"The scan was interrupted by the user.\nFiles found: {total_found}\nRecovered: {self.recovered_count}",
                    ),
                )
                return

            if not scanned_any_partition and not total_found:
                raise RuntimeError("No readable partition/filesystem found")

            msg = f"Scan completed: {total_found} files found, recovered: {self.recovered_count}"
            if errors:
                msg += f" ({len(errors)} unreadable partitions)"
            self.root.after(0, lambda: self.status_var.set(msg))

        except Exception as exc:
            self.root.after(0, lambda: messagebox.showerror("Scan error", str(exc)))
            self.root.after(0, lambda: self.status_var.set("Error during scan"))
        finally:
            self.scanning = False
            self.root.after(0, lambda: self.stop_button.configure(state="disabled"))


def main():
    root = tk.Tk()
    app = ImgFileTypeSearchApp(root)
    root.mainloop()


if __name__ == "__main__":
    main()